rust-ci.yml

name: Rust CI

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review] # Run on all non-draft PRs
    paths:
      - "crates/**"
      - "examples/**"
      - "Cargo.toml"
      - "Cargo.lock"
      - "rust-toolchain.toml"
      - ".github/workflows/rust-ci.yml"
      - "tests/**"
      - "justfile"

  # Run on main pushes
  push:
    branches:
      - main

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  # Make sure CI fails on all warnings, including Clippy lints
  RUSTFLAGS: "-Dwarnings"

jobs:
  # Fast checks run first - gate for expensive jobs
  quick-checks:
    name: Quick Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install just
        uses: extractions/setup-just@v2

      - name: Cache cargo binaries
        uses: Swatinem/rust-cache@v2
        with:
          cache-targets: false
          cache-all-crates: true

      - name: Install Rust nightly (for fmt)
        run: |
          rustup toolchain install nightly --profile minimal
          rustup component add --toolchain nightly rustfmt

      - name: Install tools
        run: |
          cargo install taplo-cli@0.9.0 --locked || true
          cargo install cargo-machete@0.7.0 --locked || true

      - name: Check Rust formatting
        run: just lint-fmt

      - name: Check TOML formatting
        run: just lint-toml

      - name: Check for unused dependencies
        run: just lint-deps

      - name: Validate justfile syntax
        run: just --unstable --fmt --check

  # Clippy runs after quick-checks pass
  lint:
    name: Clippy Lints
    needs: quick-checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install just
        uses: extractions/setup-just@v2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@master
        with:
          toolchain: stable

      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@v2

      - name: Run Clippy
        run: just lint

      - name: Check documentation builds
        run: just lint-docs
        env:
          RUSTDOCFLAGS: "-D warnings"

  # Tests run after quick-checks pass
  test:
    name: Tests
    needs: quick-checks
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6

      - name: Install just
        uses: extractions/setup-just@v2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@v2

      - name: Install nextest
        uses: taiki-e/install-action@nextest

      - name: Run tests
        run: just test

      # Fallback to standard cargo test for doctests (nextest doesn't support them)
      - name: Run doctests
        run: cargo test --workspace --doc --exclude synddb-e2e --exclude synddb-e2e-gcs

  test-stress:
    name: Session Stress Test
    needs: quick-checks
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6

      - name: Install just
        uses: extractions/setup-just@v2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@v2

      - name: Run stress test
        run: just test-stress

  test-integration:
    name: Client Integration Tests
    needs: quick-checks
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6

      - name: Install just
        uses: extractions/setup-just@v2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@v2

      - name: Run client integration tests
        run: just test-integration

  fuzz:
    name: SQLite Fuzzer
    needs: quick-checks
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6

      - name: Install just
        uses: extractions/setup-just@v2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@v2

      - name: Run fuzzer tests
        run: just fuzz
        env:
          PROPTEST_CASES: "256"

  fuzz-e2e:
    name: E2E Pipeline Fuzzer
    needs: quick-checks
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6

      - name: Install just
        uses: extractions/setup-just@v2

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@v2

      - name: Run E2E fuzzer tests
        run: just fuzz-e2e
        env:
          PROPTEST_CASES: "100"

      - name: Run E2E stress tests
        run: just fuzz-e2e-stress
        env:
          PROPTEST_CASES: "10"

  examples:
    name: Examples Compile
    needs: quick-checks
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@v2

      - name: Build crate examples
        run: |
          cargo build --package synddb-client --examples
          cargo build --package synddb-chain-monitor --examples

      - name: Build standalone examples
        run: |
          cargo build --package prediction-market
          cargo build --package price-oracle-validator

  coverage:
    name: Code Coverage
    needs: quick-checks
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview

      - name: Cache Cargo dependencies
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov

      - name: Generate coverage report
        run: cargo llvm-cov --workspace --all-features --exclude synddb-e2e --exclude synddb-e2e-gcs --lcov --output-path lcov.info

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          files: lcov.info
          fail_ci_if_error: false  # Don't fail if Codecov is unavailable
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6

      - name: Install cargo-audit
        uses: taiki-e/install-action@cargo-audit

      - name: Run security audit
        run: cargo audit